<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 09/16/2014 06:33 AM, Richard Hughes
wrote:<br>
</div>
<blockquote
cite="mid:CAD2FfiEKuS2BD=YqUXsHfsXGe2zTUoTUSGgXQNYbkrp5EcqyDA@mail.gmail.com"
type="cite">
I've triaged many bugs to do with online and offline
update failures, and if we're going to say that we actually care
about
the users data, it becomes increasingly hard to defend the "old"
way
of doing it. I'm sure I could find numerous bugs numbers where
doing
an online update made the session/terminal crash which of course
leaves you with duplicate packages on your system which may or may
not
be fixable.
Richard
</blockquote>
OK, but this is means that we painted ourselves in the
corner---something is wrong if my Android phone, which I don't have
to reboot for updates, has higher uptime than my computer. <br>
<br>
We are in a bind: on one hand, the best security practice is to
upgrade daily to avoid emerging vulnerabilities; on the other hand
daily reboots aren't really a nutritious alternative. Something has
to give---which one do we do:<br>
<br>
- create a separate daily security upgrade stream, curated to not
require reboots if at all possible<br>
<br>
- follow Microsoft and do a fixed 'patch Tuesday' schedule instead
of ASAP updates<br>
<br>
- rewrite Linux or at least Gnome/DBus for safe updates :)<br>
<br>
<br>
</body>
</html>